North Korea-Linked 'Ted' Backdoor Found Compiled Inside HAProxy at South Korean Automotive and Media Firms

Rapid7 says a previously undocumented Linux toolkit, centered on a backdoor (ted) compiled into victims' HAProxy 2.8.12 builds, was used against two South Korean organizations in the automotive and media sectors, with medium-confidence attribution to North…

Rapid7 documented a stealthy Linux espionage toolkit targeting two South Korean organizations in the automotive and media sectors. Its centerpiece is the 'ted' backdoor, compiled directly into the victims' HAProxy 2.8.12 load balancer binaries using HAProxy's native filter API, memory pools, and scheduler, allowing it to intercept web traffic, serve altered or injected pages only to selected visitors (a watering-hole capability), and hide its command-and-control exchanges from backend logs and HAProxy statistics. C2 commands arrive hidden in requests for a fake image path (/favorite_list_2x_m500_ico.jpg) and are stored in a named pipe, while logs and bash history are scrubbed; Report 1 adds that C2 is concealed by decrementing HAProxy connection counters and responses are disguised as HTTP/1.0 200 OK pages. The toolkit also trojanizes the crond, sshd, agetty, atd, and polkitd binaries, includes an SSH keylogger used to harvest credentials for lateral movement, and runs a companion RAT, curlRAT, that beacons on a default 12-hour schedule, can deploy an interactive PTY shell, and performs anti-VM checks. Traffic mimics Naver's pstatic.net and low-cost TLD domains are used; SecurityWeek reports initial access came via an exploited Groupware login portal flaw and estimates the toolkit has likely been in use since late 2024. Attribution is at medium confidence to North Korean state-sponsored actors, with six C2 domains overlapping APT37 listings in maltrail and infrastructure and artifacts overlapping the Lazarus-linked Operation SyncHole campaign; Security Affairs notes the campaign's command domains have since gone dark. Sources do not fully agree on the actor: overlaps point to both APT37 and Lazarus's Operation SyncHole.

• The 'ted' backdoor was compiled into victims' own HAProxy 2.8.12 builds using HAProxy's native filter API, memory pools, and scheduler; it is not a HAProxy flaw and required prior code execution (per The Hacker News).
• Two South Korean organizations were hit, in the automotive and media sectors.
• ted intercepts HTTP traffic and can inject scripts or replace page content per victim IP, fingerprint, or a hidden Accept-Language credential, turning the load balancer into a watering hole.
• C2 commands arrive via requests for a fake image path /favorite_list_2x_m500_ico.jpg, are stored in a named pipe, and are hidden from logs; The Hacker News reports counters are manipulated by decrementing HAProxy connection counters and…
• The toolkit trojanizes crond, sshd, agetty, atd, and polkitd binaries and includes an SSH keylogger used to harvest credentials.
• curlRAT beacons on a default 12-hour schedule, can deploy an interactive PTY shell (per SecurityWeek), and performs anti-VM/virtualization checks (per Security Affairs).
• Payload traffic mimics Naver's pstatic.net, and low-cost TLD domains are used; six C2 domains overlap APT37 entries in maltrail (per The Hacker News).
• SecurityWeek reports initial access was via an exploited Groupware login portal flaw, with credential harvesting enabling lateral movement.